CVE-2016-2152

Published: May 22, 2016Modified: May 6, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an external DB profile field.

Affected (33)

Products: Moodle: Moodle

Moodle

1 product

Moodle

Configuration A

33 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Up to 2.6.11
Moodle Moodle	Version 2.7.0
Moodle Moodle	Version 2.7.10
Moodle Moodle	Version 2.7.11
Moodle Moodle	Version 2.7.12
Moodle Moodle	Version 2.7.1
Moodle Moodle	Version 2.7.2
Moodle Moodle	Version 2.7.3
Moodle Moodle	Version 2.7.4
Moodle Moodle	Version 2.7.5
Moodle Moodle	Version 2.7.6
Moodle Moodle	Version 2.7.7
Moodle Moodle	Version 2.7.8
Moodle Moodle	Version 2.7.9
Moodle Moodle	Version 2.8.0
Moodle Moodle	Version 2.8.10
Moodle Moodle	Version 2.8.1
Moodle Moodle	Version 2.8.2
Moodle Moodle	Version 2.8.3
Moodle Moodle	Version 2.8.4
Moodle Moodle	Version 2.8.5
Moodle Moodle	Version 2.8.6
Moodle Moodle	Version 2.8.7
Moodle Moodle	Version 2.8.8
Moodle Moodle	Version 2.8.9
Moodle Moodle	Version 2.9.0
Moodle Moodle	Version 2.9.1
Moodle Moodle	Version 2.9.2
Moodle Moodle	Version 2.9.3
Moodle Moodle	Version 2.9.4
Moodle Moodle	Version 3.0.0
Moodle Moodle	Version 3.0.1
Moodle Moodle	Version 3.0.2